Annex 2: Implementation of the Action Plan on the National Cybersecurity Strategy of the Czech Republic 2021–2025 The year 2023 marked the third year of evaluation for the Action Plan on the National Cybersecurity Strategy of Czech Republic 2021–2025 (the “Action Plan”). NÚKIB has a pivotal role in coordinating evaluation of the entire Action Plan and is responsible for or collaborates on 101 out of 105 tasks. Several factors may negatively impact the implementation rate of the Action Plan. Under the Action Plan, some tasks are prioritised according to time and the capacity of the responsible authorities. Limited financial capacity or other internal organisational challenges within responsible authorities or collaborating entities may also affect the progress and completion of tasks. Eighty-five tasks were evaluated for 2023. Seventy-one tasks were either completed or continually fulfilled. Fourteen tasks were only partially completed and will carry over to 2024. In 2022, nine tasks were partially completed, indicating a slight decrease in the task completion success rate for 2023. No tasks were assessed as unfulfilled in 2023. 14 Partially Fulfilled 71 Fulfilled/Being Fullfilled Continuously Figure 25: Implementation of the Action Plan during 2023 An example of a task due and completed in 2023 is Task 40: “Perform a legal review of the state of cyber hazards in the context of other crisis scenarios and prepare proposals for possible legislative changes.” The state of cyber hazards was revised under the proposal for a new CSA. This included a revision of crisis legislation in cooperation with the body responsible for crisis management, the Directorate General of the Fire Rescue Service of the Czech Republic. The legislation on cyber hazards was successfully reworded. An example of a task only partially completed is Task 83: “Develop a concept for the protection of sensitive non-classified information.” NÚKIB conducted an analysis of the status quo and after discussion with internal and external partners, prepared an internal draft concept for the protection of non-classified information. However, the draft has not yet been approved. This task will be carried over to 2024 for further discussion with external bodies and submission to the security council. The Action Plan also includes interim tasks that are evaluated annually. For example, Task 67: “Participate in and actively contribute to the organisation, preparation and conduct of international exercises and actively support the network of major cybersecurity partners through joint cyber exercises.” In 2023, the Czech Republic, through NÚKIB and other bodies, participated in organising and executing several international exercises (e.g., Cyber Coalition, NATO CMX 2023). Its participation in these activities is expected to continue. 49